Organic Law on Personal Data Protection (Ley Organica de Proteccion de Datos Personales)

A GDPR-modeled statute. Article 5 applies it to processing carried out in Ecuadorian territory, to controllers or processors established in Ecuador, and — extraterritorially — to those outside Ecuador that offer goods or services to people in Ecuador or monitor their behavior there. It carries GDPR-style rights (access, rectification, erasure, portability, objection to automated decisions), breach notification, DPO requirements for larger or higher-risk processing, and fines calibrated to turnover. The two-year transition ended May 26, 2023, at which point the sanctions regime became enforceable; the supervisory authority (the Superintendencia de Proteccion de Datos Personales) was stood up later than the law itself, so enforcement practice is still maturing — a reason to confirm current regulator guidance rather than assume the statute is being applied exactly as written.